nginx SSL redirect not working - express

I have nginx configured to forward traffic to an express server and want to force SSL by redirecting traffic directed at http:// to https://. I've done extensive googling on the subject however can not get this to work. HTTPS is working fine but so is HTTP - the redirect does not appear to be having any effect.
server {
listen 80;
listen [::]:80;
server_name my.domain www.my.domain;
return 301 https://my.domain$request_uri;
}
server {
listen 443 ssl default_server;
listen [::]:443 ssl;
server_name my.domain www.my.domain;
ssl_certificate /home/user/my_domain.crt;
ssl_certificate_key /home/user/my_domain.key;
ssl on;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/mydomain.access.log;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https://localhost:3000;
proxy_read_timeout 90;
proxy_redirect https://localhost:3000 https://my.domain;
}
}

i have also the same problem so I apply these to server to accept only one request which will decide for both http and https
server {
listen 80 ;
listen [::]:80 ;
listen 443 ssl http2 ;
listen [::]:443 ssl http2 ;
server_name example.com www.example.com;
#------ ssl certificates and other config --------
set $https_redirect 0;
#if request came from port 80/http
if ($server_port = 80) {
set $https_redirect 1;
}
# or if the requested host came with www
if ($host ~ '^www\.') {
set $https_redirect 1;
}
#then it will redirects
if ($https_redirect = 1) {
return 301 https://example.com$request_uri;
}
}
by using this I have only server block to hanlde any request

Related

How to redirect different subdomains to applications running on different ports with nginx

I have 2 nodejs applications running in my EC2 instance at PORT 3000 and 1337. What I want to achieve is
admin.mydomain.com
should be redirected to the application running on PORT 1337 and
mydomain.com www.mydomain.com
should be redirected to the application running on PORT 3000.
With my current nginx configuration I am getting a 502
map $subdomain $subdomain_port {
default 3000;
www 3000;
admin 1337;
}
server {
listen 80;
listen [::]:80;
server_name _;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name ~^(?P<subdomain>.+?)\.historydiaries\.com$;
location / {
proxy_pass http://localhost:$subdomain_port;
proxy_redirect off;
}
ssl_certificate /etc/letsencrypt/live/historydiaries.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/historydiaries.com/privkey.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_session_cache shared:SSL:5m;
ssl_session_timeout 1h;
add_header Strict-Transport-Security “max-age=15768000” always;
}
You can achieve this using two different nginx conf
I will go with separate Nginx vhost configuration.
One for www.mydomain.com and another one for admin.mydomain.com
server {
listen 80;
server_name www.mydomain.com;
access_log /var/log/nginx/mydomain_access.log;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_pass http://localhost:3000/;
proxy_redirect off;
}
}
and
server {
listen 80;
server_name admin.mydomain.com;
access_log /var/log/nginx/admin.mydomain_access.log;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_pass http://localhost:1337/;
proxy_redirect off;
}
}
This just simple vhost configuration. You can add Let's Encrypt later when you need.

Magento 2 - 502 Bad Gateway after ssl configuration

I am using a ssl certificate provided by comodo that seems to me to be propely configured because my website is showing the https correctly. However, I am getting 502 Bad Gateway when I access my store with ssl.
I am using nginx server and this is how I am doing this.
server {
root /var/www/html/public/;
index index.php index.html;
listen 80 default_server;
error_log /var/log/nginx/error-zzdefault.log;
access_log /var/log/nginx/access-zzdefault.log;
location / {
proxy_pass http://magento/;
}
location /phpmyadmin/ {
proxy_pass http://phpmyadmin/;
}
}
server {
listen 443 ssl;
server_name mydomain.com.br;
keepalive_timeout 70;
ssl_certificate /etc/nginx/ssl/mydomain-bundle.crt;
ssl_certificate_key /etc/nginx/ssl/mydomain.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
error_log /var/log/nginx/error-zzdefault.log;
access_log /var/log/nginx/access-zzdefault.log;
root /var/www/html/public/;
index index.php index.html;
location / {
proxy_pass https://magento/;
}
}
Alter the proxy_pass on the second server location who has SSL certified:
The Ip 32.999.999.999:80 should be your server main Ip address. Passing
the default port 80.
location / {
proxy_pass http://32.999.999.999:80;
      proxy_set_header X-Real-IP  $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header X-Forwarded-Port 443;
      proxy_set_header Host $host; }

Nginx server : Redirecting www, ip and non-ssl

I have been struggling with my Nginx server's .conf file. I am getting a redirection loop error while trying to redirect these urls :
http://example.com
http://www.example.com
https://www.example.com
http://11.111.11.11
https://11.111.11.11
to : https://example.com
So what I am trying to do is to redirect every non-ssl url, www prefixed url and my server's ip address to my domain name.
Here is my code :
# redirect ip to domain name
server {
listen 80;
listen 443 ssl;
server_name 11.111.11.11; #server_ip
ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;
return 301 $scheme://mydomain.com$request_uri;
}
# HTTP — redirect all traffic to HTTPS
server {
listen 80;
listen 443 ssl;
server_name www.mydomain.com;
ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;
return 301 $scheme://mydomain.com$request_uri;
}
# HTTPS — proxy all requests to the Node app
server {
# Enable HTTP/2
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name mydomain.com;
# Use the Let’s Encrypt certificates
ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;
# Include the SSL configuration from cipherli.st
include snippets/ssl-params.conf;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-NginX-Proxy true;
proxy_pass http://localhost:5000/;
proxy_ssl_session_reuse off;
proxy_set_header Host $http_host;
proxy_cache_bypass $http_upgrade;
proxy_redirect off;
}
}
Ok, I searched the web a little these last few days and it seems that the solution below works :
# HTTP — redirect all traffic to HTTPS
server {
listen 80;
listen [::]:80 default_server ipv6only=on;
server_name www.example.com 00.000.00.00; # www and your ip address
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
return 301 https://example.com$request_uri;
}
# HTTPS — proxy all requests to the Node app
server {
# Enable HTTP/2
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name example.com;
# Use the Let’s Encrypt certificates
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
# Include the SSL configuration from cipherli.st
include snippets/ssl-params.conf;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-NginX-Proxy true;
proxy_pass http://localhost:5000/;
proxy_ssl_session_reuse off;
proxy_set_header Host $http_host;
proxy_cache_bypass $http_upgrade;
proxy_redirect off;
}
}
To document this a bit more, I was trying to proxy the nginx server to a nodejs server on port 5000. Also, I used this tutorial to setup the server and the conf file : https://code.lengstorf.com/deploy-nodejs-ssl-digitalocean/#enable-nginx
Hope this will help someone.

SSL support Docker Swarm with Nginx

I am attempting to setup SSL with Nginx running on a docker swarm but have run into an issue. Everything looks correct but any request I make just hangs until I get a 502. I made sure to expose port 443 in my compose file. Here is the nginx error I am getting:
*7 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 10.255.0.2, server: subdomain.mysite.com, request: "GET /api-v1/user-login HTTP/2.0", upstream: "https://10.0.0.6:5051/api-v1/user-login", host: "subdomain.mysite.com"
Here is the relevant piece of my nginx default.conf:
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_protocols SSLv3 TLSv1;
upstream siteStage {
ip_hash;
server siteStage:5051;
}
server {
listen 443 ssl http2 ;
server_name subdomain.mysite.com;
ssl on;
ssl_certificate /path/provided.crt;
ssl_certificate_key /path/client.key;
ssl_client_certificate /path/ca.crt;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_verify_client off;
location / {
proxy_ssl_certificate /etc/ssl/client.pem;
proxy_ssl_certificate_key /etc/ssl/client.key;
proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
proxy_ssl_ciphers HIGH:!aNULL:!MD5;
proxy_ssl_session_reuse on;
proxy_pass https://siteStage/;
}
}
It turns out it was my nginx config. Here is how I finally got it to work:
# No upstream
server {
listen 80;
listen 443 ssl default_server;
server_name subdomain.mysite.com;
ssl on;
ssl_certificate /path/provided.crt;
ssl_certificate_key /path/client.key;
if ($scheme = http) {
return 301 https://$server_name$request_uri;
}
location / {
proxy_pass http://siteStage:5051/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto "https";
}
}

Apply SSL and www in main domain and not in subdomain in nginx

I am working on to apply SSL (https) and www to domain ("https:// www.xyz.com") in the browser whenever I type anything for the domain ("xyz.com").
I have subdomains as well and I don't want to apply "www" in subdomains (this is working fine).
Everything is working great except if I type "https:// xyz.com" in the browser, ngingx doesn't apply www (it should be "https:// www.xyz.com") but it gives "https:// xyz.com" only.
Following is the config file of sites-available:
server {
listen 443;
server_name xyz.com *.xyz.com;
ssl on;
ssl_certificate /etc/nginx/ssl/xyz.crt;
ssl_certificate_key /etc/nginx/ssl/*.xyz.com.key;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http://127.0.0.1:8069;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
proxy_buffer_size 128k;
proxy_buffers 16 64k;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
location ~* /web/static/ {
proxy_buffering off;
proxy_pass http://127.0.0.1:8069;
}
}
}
server {
listen 80;
server_name xyz.com;
add_header Strict-Transport-Security max-age=2592000;
rewrite ^/.*$ https://www.$host$request_uri? permanent;
}
server {
listen 80;
server_name *.xyz.com;
add_header Strict-Transport-Security max-age=2592000;
rewrite ^/.*$ https://$host$request_uri? permanent;
}
Kindly guide me where I am doing wrong.
Thanks in advance.
move add_header Strict-Transport-Security max-age=2592000; option to ssl server block with 443 port.
server {
listen 443;
add_header Strict-Transport-Security max-age=2592000;
# rest configs
}
Change http 80 block to
server {
listen 80;
listen [::]:80;
server_name example.com;
return 301 https://www.example.com$request_uri; # permenent redirect
}
NOTE: any changes made to nginx config needs a reload signal to nginx process to apply the changes in ubuntu it requires sudo service nginx reload